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PRE- APPEAL BRIEF REQUEST FOR REVIEW 



Applicant requests review of the final rejection in the above-identified application. No 
amendments are being filed. This request is being filed with a Notice of Appeal. 

CLAIMS 1 AND 22 

Claim 1 was rejected as being obvious over the asserted combination of Bass and Leeds. 
As conceded in the Office Action, Bass fails to disclose preventing dissemination that comprises 
at least one of changing a routing table, changing a forwarding table, turning off at least one of a 
forwarding device, filtering on Internet Protocol (IP) addresses, and filtering on media access 
control (MAC) addresses. 8/4/2005 Office Action at 5. However, the Office Action relied upon 
Leeds as disclosing the feature missing from Bass. Id. In particular, the Office Action asserted 
that Leeds teaches preventing dissemination by changing a routing table (citing column 6, lines 
59-62, of Leeds). Id. Applicant respectfully submits that a prima facie case of obviousness has 
not been established with respect to Bass and Leeds. 

As conceded by the Office Action, Bass clearly does not disclose the last clause of claim 
1 . However, the reliance on Leeds as teaching the feature in this last clause of claim 1 is clearly 
misplaced. Leeds describes a system for parsing and analyzing incoming e-mail messages to 
determine whether messages are junk e-mail. See Leeds, Abstract. As described in connection 
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with Fig. 8 of Leeds, an authentication server 700 is able to verify whether an identifier issued to 
a mail originator remains valid and has not been reported as a spam abuser. Leeds, 6:55-59. If a 
recipient has received spam, the identifier is matched with a spam designation based upon the 
number of mail recipients reporting the problem. Leeds, 6:59-63. The reported identifier is then 
assigned to a spam section of an authentication database 710. Leeds, 6:63-65. Thus, what is 
occurring in Leeds is the association of identifiers in a spam database that identify originators of 
spam e-mail. Filtering is performed based on the content of this spam database. 

Contrary to the assertion made in the Office Action, associating an identifier with a spam 
designation does not constitute changing a routing table. Therefore, because neither Bass nor 
Leeds teaches or suggests the claimed invention, it is respectfully submitted that the hypothetical 
combination of Bass and Leeds does not teach or suggest all elements of claim 1. 

Moreover, no motivation or suggestion existed to combine the teachings of Bass and 
Leeds. Bass describes a technique for reducing likelihood of broadcast storms in a network 
based on the transmission of multiple destination messages (such as broadcast messages or 
multicast messages). Bass, 1:23-34; 2:11-14. Bass indicates that multiple destination messages 
are classified into multiple broadcast message classes, with a count associated with each 
broadcast message class. Bass, 2:24-33. If the count of a particular class of multiple destination 
messages exceeds a threshold, then this class of multiple destination messages is discarded to 
reduce the likelihood of a broadcast storm. Bass, 6:6-10. 

In contrast to counting multiple destination messages performed in Bass for the purpose 
of preventing broadcast storms, Leeds is associated with a quite different concern, namely 
filtering junk e-mail or spam. Filtering junk e-mail involves a problem and a solution to that 
problem that are completely different from the problem and solution associated with preventing 
broadcast storms as performed in Bass. A person of ordinary skill in the art would not have been 
motivated to employ the spam designation technique described in Leeds with the broadcast storm 
prevention technique of Bass (which involves determining whether a count of certain types of 
messages exceeds a threshold). Clearly, no' motivation or suggestion existed to combine the 
teachings of Bass and Leeds. 

Independent claim 22 is clearly allowable for similar reasons. 

CLAIM 42 

Independent claim 42 was also rejected as being obvious over Bass and Leeds. The 
Office Action conceded that Bass does not disclose the means for determining if the information 
about the pattern of behavior from any of the computers is trustworthy. Reliance was made on 
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Leeds as teaching this element missing from Bass. It is respectfully submitted that a prima facie 
case of obviousness has also not been established with respect to claim 42. 

As conceded by the Office Action, Bass does not disclose the means for determining if 
the information about the pattern of behavior from any of the computers is trustworthy. 8/4/2005 
Office Action at 8. Moreover, contrary to the incorrect assertion in the Office Action, Bass also 
fails to disclose another element of claim 42, namely the means for monitoring the network for 
any patterns of behavior, including, if available, information about a pattern of behavior from 
any of the computers about another one of the computers. This monitoring means of claim 42 
monitors information from one of the computers about another one of the computers. 
Monitoring for such information is not performed at all in Bass. In Bass, a switch 10 or 
computer 26 (see Fig. 1 of Bass) contains a mechanism that includes counters for counting 
multiple destination messages of different classes. The information maintained by the counters 
cannot constitute information from any of the computers about another one of the computers. 

Because of this defective application of Bass to the claimed subject matter, the 
obviousness rejection is defective for at least this reason. 

The obviousness rejection is further defective for the reason that Leeds does not disclose 
or suggest the means for determining if the information about the pattern of behavior from any of 
the computers is trustworthy. Determining whether an incoming mail message is a junk e-mail, 
as performed by Leeds, is not the same as determining if information about a pattern of behavior 
from any of the computers is trustworthy. Leeds does not teach or even remotely suggest that the 
e-mails received by the authenticator of Leeds contains any information about a pattern of 
behavior. Thus, the citation of Leeds as teaching the means for determining if the information 
about the pattern of behavior from any of the computers is trustworthy is erroneous, as Leeds 
does not teach or suggest the element conceded by the Office Action as missing from Bass. 

In view of the foregoing, it is clear that the hypothetical combination of Bass and Leeds 
does not teach or suggest all elements of claim 42. Additionally, for reasons stated above, there 
existed no motivation or suggestion to combine the teachings of Bass and Leeds. The prima 
facie case of obviousness is defective for this additional reason. 

CLAIM 59 

Independent claim 59 was rejected as being obvious over Bass and Arndt. It is 
respectfully submitted that a prima facie case of obviousness has not been established with 
respect to claim 59. 
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The Office Action conceded that Bass does not disclose monitoring a network for an 
undesirable pattern comprising at least one of a stolen IP address, stolen MAC address, 
malformed packet, too many probe packets directed to a firewall, and too many address 
resolution protocol packets. 8/4/2005 Office Action at 27. However, the Office Action relied 
upon Arndt as disclosing this feature. Id. 

It is respectfully submitted that a person of ordinary skill in the art would not have been 
motivated to combine the teachings of Bass and Arndt to achieve the claimed invention. As 
discussed above, Bass is related to a mechanism that includes counters for counting whether 
different classes of multiple destination messages exceed a threshold, and if such a threshold is 
exceeded, discarding the multiple destination messages. Bass performs such tasks for the 
purpose of preventing broadcast storms. The teachings of Arndt are completely unrelated to the 
prevention of broadcast storms. Arndt is related to a method and device for automatically 
obtaining a valid IP configuration in a local area network and a test instrument for networks. 
Arndt, 1:8-11. The method described in Arndt for obtaining an IP configuration automatically 
involves continuously monitoring traffic to identify local addresses, corresponding subnet masks, 
local routers, and servers. Arndt, 2:22-27. However, there is absolutely no teaching or 
suggestion in Arndt that the network monitoring performed in Arndt is applicable for the purpose 
of preventing broadcast storms. Also, clearly, Arndt has nothing to do with determining a type 
of the undesirable pattern that is monitored, where the undesirable pattern comprises at least one 
of a stolen IP address, stolen MAC address, malformed packet, too many probe packets directed 
to a firewall, and too many address resolution protocol packets, for the purpose of mitigating the 
undesired pattern based on the type of undesirable behavior. Thus, clearly, a person of ordinary 
skill in the art would not have been motivated to combine the teachings of Bass and Arndt to 
achieve the subject matter of claim 59. A prima facie case of obviousness has therefore not been 
established with respect to claim 59. 

CLAIM 61 

Independent claim 61 was rejected as being obvious over Bass and Regan. A prima facie 
case of obviousness has not been established with respect to claim 61. 

As conceded by the Office Action, Bass does not disclose discovering a topology of the 
network, and causing prevention of dissemination over the network of packets associated with 
the undesirable behavior based on the type of the undesirable behavior and topology of the 
network. 8/4/2005 Office Action at 29. Reliance was made on Regan as teaching this element 
that is missing from Bass. Id. 



4 



Appln. Serial No. 09/991,108 
Pre-Appeal Brief Request for Review 

Applicant respectfully submits that the reliance on Regan as teaching an element missing 
from Bass is misplaced. Regan describes use of a Spanning Tree Protocol (STP) that is designed 
to allow bridges to map a network topology while eliminating loops which could lead to 
broadcast storms. Regan, 2:7-13. Regan also teaches a bridge that employs a prior distance 
vector protocol and learning processes to manage the topology of a bridge network layer. Regan, 
4:56-59. Additionally, the network topology information is retained in a filtering database that is 
configured by a management action or by a learning process and algorithm. Regan, 6:40-45. 
There is no teaching or suggestion in Regan of discovering a topology of the network, in 
combination with causing prevention of dissemination over the network of packets associated 
with the undesirable behavior based on the topology of the network (as well as based on the type 
of the undesirable behavior). Thus, the hypothetical combination of Bass and Regan does not 
teach or suggest all elements of claim 61. 

Moreover, a person of ordinary skill in the art would not have been motivated to combine 
the teachings of Bass and Regan. Regan is directed to a method and apparatus for dynamically 
managing the topology of a data network. Regan, 2:66-3:1. A bridge depicted in Fig. 1 of 
Regan employs a prior distance vector protocol and learning processes to manage the topology of 
the layer 2 learning bridge network layer 106. Regan, 4:56-69. Although reference is made to 
managing topology, there is no teaching or suggestion whatsoever in Regan of causing 
prevention of dissemination over the network of packets associated with an undesirable behavior 
based on the type of the undesirable behavior and topology of the network. Thus, a person of 
ordinary skill in the art would not have been motivated to use the topology management 
technique taught by Regan in the system of Bass, where counters are used to count numbers of 
multiple destination messages to determine if a threshold has been crossed. A prima facie case 
of obviousness is thus defective for this additional reason. 

Thus, clear legal and factual errors have been committed in the obviousness rejections of 
the claims. 
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